Skip to content
OpenAdvisories

Archive

20 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /20 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

46 results · Feed

  • Critical 9.1
    CVE-2026-9265

    Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path

    Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL te…

    JONASBN Crypt::OpenSSL::PKCS12 libcrypt-openssl-pkcs12-perl libcrypt-openssl-pkcs12-perl Debian Ubuntu
  • High 8.3
    CVE-2026-56215

    Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning

    Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO ema…

    Capgo Capgo
  • High 8.8
    CVE-2026-56216

    Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey

    Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted keys by setting empty limits. Attackers with a compromised app-limited key can create an unrestrict…

    Capgo Capgo
  • High 7.5
    CVE-2026-56214

    Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC

    Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows unauthenticated attackers to enumerate organizations and disclose billing status using the public sb_publisha…

    Capgo Capgo
  • Medium 5.3
    CVE-2026-56213

    Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC

    Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into version_meta for any app_id. Attackers…

    Capgo Capgo
  • Low 3.8
    CVE-2026-56212

    Capgo - Improper 2FA Enforcement Logic via Team Security Settings

    Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authentication for all team members without first enabling 2FA on their own account. The appli…

    Capgo Capgo